90640 matches found
EUVD-2026-60916
Contributor Arbitrary File Upload in GP Premium = 2.5.5 versions...
CVE-2026-66627
Contributor Arbitrary File Upload in GP Premium = 2.5.5 versions...
CVE-2026-66622
Unauthenticated SQL Injection in Depicter Slider = 4.8.0 versions...
CVE-2026-66621
Unauthenticated reflected XSS affects the Ultimate Dashboard WordPress plugin up to version 3.11.2, scored CVSS 7.1 (HIGH). No patch version or exploitation evidence is provided; users should update to a fixed release when available and apply WAF rules for XSS filtering.
CVE-2026-66620
Editor PHP Object Injection in OptionTree = 2.7.3 versions...
CVE-2026-66620
The WordPress OptionTree plugin (≤ 2.7.3) is vulnerable to PHP Object Injection via its Editor component. CVSS 7.2 (HIGH) reflects network attack vector, low complexity, and high impact across confidentiality, integrity, and availability, requiring attacker privileges. Exploitation details are no...
CVE-2026-32553
The WordPress OttoKit plugin (versions
CVE-2026-32553
Unauthenticated Server Side Request Forgery SSRF in OttoKit = 1.1.35 versions...
EUVD-2026-60911
Unauthenticated Broken Access Control in ThumbPress 6.5 versions...
CVE-2026-32547
Unauthenticated Cross Site Scripting XSS in BP Better Messages = 2.15.22 versions...
CVE-2026-32481 WordPress Ezoic plugin <= 2.22.11 - Broken Authentication vulnerability
Unauthenticated Broken Authentication in Ezoic = 2.22.11 versions...
CVE-2026-32481
The WordPress Ezoic plugin (versions ≤ 2.22.11) contains an unauthenticated broken authentication flaw discovered by HaiND. CVSS 7.5 HIGH (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) means any remote attacker can bypass authentication and access confidential data without credentials. No fix version or i...
EUVD-2026-60909
Unauthenticated Broken Authentication in Ezoic = 2.22.11 versions...
CVE-2026-32474
Contributor Arbitrary File Upload in Templatiq = 0.2.5 versions...
EUVD-2026-60908
Contributor Arbitrary File Upload in Templatiq = 0.2.5 versions...
CVE-2026-32474 WordPress Templatiq plugin <= 0.2.5 - Arbitrary File Upload vulnerability
Contributor Arbitrary File Upload in Templatiq = 0.2.5 versions...
CVE-2026-32473
The "pdf-smart-viewer-for-elementor" WordPress plugin (versions ≤ 1.0.4) allows unauthenticated attackers to force server-side HTTP requests, enabling internal network access or metadata probing. CVSS 7.2 (HIGH) reflects network access with low impact. No exploitation observed; update to a patche...
CVE-2026-32473
Unauthenticated Server Side Request Forgery SSRF in PDF Smart Viewer for Elementor = 1.0.4 versions...
CVE-2026-32470
The WordPress FundEngine plugin (versions ≤ 1.7.9) is vulnerable to unauthenticated PHP Object Injection, discovered by researcher daroo. CVSS 3.1 scores this critical (9.8) with network attack vector, no privileges or user interaction required, impacting confidentiality, integrity, and availabil...